Methods and apparatuses for creating authenticatable printed articles and subsequently verifying them

ABSTRACT

A printer with integral scanner obtains a digital signature from an article as it is printed. The integral scanner has a coherent source which directs a light beam to illuminate the article and a detector arrangement to collect data points from light scattered from many different parts of the article to collect a large number of independent data points. The digital signature derived from the data points is stored in a database with an image of what was printed on the article. The authenticity of an article purported to be the originally printed article can be verified by scanning the purported genuine article to obtain its digital signature. The database is then searched, to establish whether there is a match. If a match is found, the image is displayed with the matched digital signature to allow a further visual check that the article is genuine.

CROSS-REFERENCE TO RELATED APPLICATIONS

This is a continuation of application Ser. No. 10/592,593, filed Aug.15, 2007, which is the U.S. national stage of International ApplicationNo. PCT/GB05/00903, filed Mar. 9, 2005, and which claims the benefit ofApplication No. 60/601,463, filed Aug. 13, 2004, Application No.60/601,464, filed Aug. 13, 2004, Application No. 60/610,075, filed Sep.15, 2004, GB 0405641.2, filed Mar. 12, 2004, GB 0420524.1, filed Sep.15, 2004, and GB 0418138.4, filed Aug. 13, 2004. All of theseapplications are incorporated herein by reference.

BACKGROUND OF THE INVENTION

The invention relates to security methods, more especially verificationof authenticity of a printed document or other printed article such as apersonal identification (ID) card, cardboard packaging item, or a uniquedocument such as a bill of lading or document bearing an originalsignature, seal or stamp.

Many traditional authentication security systems rely on a process whichis difficult for anybody other than the manufacturer to perform, wherethe difficulty may be imposed by expense of capital equipment,complexity of technical know-how or preferably both. Examples are theprovision of a watermark in bank notes and a hologram on credit cards orpassports. Unfortunately, criminals are becoming more sophisticated andcan reproduce virtually anything that original manufacturers can do.

Because of this, there is a known approach to authentication securitysystems which relies on creating security tokens using some processgoverned by laws of nature which results in each token being unique, andmore importantly having a unique characteristic that is measurable andcan thus be used as a basis for subsequent verification. According tothis approach tokens are manufactured and measured in a set way toobtain a unique characteristic. The characteristic can then be stored ina computer database, or otherwise retained. Tokens of this type can beembedded in the carrier article, e.g. a banknote, passport, ID card,important document. Subsequently, the carrier article can be measuredagain and the measured characteristic compared with the characteristicsstored in the database to establish if there is a match.

Within this general approach it has been proposed to use differentphysical effects. One effect that has been considered is to measure amagnetic response characteristic from depositions of magnetic materials,where each sample has a unique magnetic response as a result ofnaturally occurring defects in the magnetic material which form in anirreproducible manner [1]. Another effect that has been considered in anumber of prior art documents is to use laser speckle from intrinsicproperties of an article to provide a unique characteristic.

GB 2 221 870 A [2] discloses a method in which a security device, suchas an ID card, effectively has a token embossed on it. The form of thetoken is a structured surface derived from a master. The speckle patternfrom the light scattering structure is unique to the master andtherefore can be measured to prove authenticity of the token on thesecurity device. The token on the security device is measured in areader which has a laser for generating a coherent beam of a sizeroughly equal to the token (2 mm diameter) and a detector, such as acharged coupled device (CCD) detector, for measuring the speckle patterncreated by the interaction of the laser beam with the token. Theresulting data is recorded. For verification, a security device can beplaced in the reader and its recorded speckle pattern signal comparedagainst a similar recorded signal from a reference device created fromthe same master.

U.S. Pat. No. 6,584,214[3] describes an alternative to using specklepatterns in reflection from a specially prepared surface structure, inwhich speckle patterns are instead used in transmission from a speciallyprepared transparent token. The preferred implementation of thistechnique is to prepare epoxy tokens of dimension approximately 1 cm×1cm in which glass spheres are embedded. The tokens are prepared bymixing the glass spheres in a colloidal suspension in a liquid polymer,which is then cured to fix the positions of the glass spheres. Theunique ensemble of glass spheres is then probed using a coherent laserbeam in transmission with a CCD detector positioned to measure thespeckle pattern. In a modification of this approach, a known identifieris encoded on a reflective surface which is then stuck to one side ofthe token. The probing light passes through the token, is reflected bythe known identifier and passes through the token again. The glassspheres thus modify the speckle pattern so that a unique hashed key isgenerated from the known identifier.

Kralovec [4] briefly reports that in the 1980's workers at SandiaNational Laboratories in the US experimented with special banknote paperwhich was impregnated with chopped-up optical fibres. A speckle patterncould be measured from the optical fibres and a digitally signed versionof this printed as a barcode on the side of the note. However, Kralovecreports that this idea could not be made to work properly, because theoptical fibres were too fragile and the speckle pattern changed rapidlywhen the banknote was circulated owing to wear. This meant that thespeckle pattern measured from the optical fibres in a used banknote nolonger matched the barcode, so the banknote could no longer beauthenticated from the speckle pattern in the intended manner.

Anderson [5] on page 251 of his 2001 text book also briefly refers towhat appears to be a similar scheme to that described by Kravolec [4]which is used for monitoring arms control agreements. Anderson observesthat many materials have surfaces that are unique or that can be made soby eroding them with a small explosive charge. This is said to make iteasy to identify capital equipment such as heavy artillery, whereidentifying each gun barrel is enough to prevent cheating by eitherparty to an arms control agreement. Anderson reports that the surfacepattern of the gun barrel is measured using laser speckle techniques,and either recorded in a log or attached to the device as amachine-readable digital signature.

Instead of using laser speckle, there is a more-straightforward group ofproposed schemes that simply image an article at high resolution and usethis high resolution image as the unique characteristic, which can thenbe re-imaged subsequently for verification of authenticity. This may beregarded as an adaptation of the conventional approach used forfingerprint libraries held by police forces.

U.S. Pat. No. 5,521,984[6] proposes using an optical microscope to takean image of a small area of a valuable article, such as a painting,sculpture, stamp, gem or specific document.

Anderson [5] on page 252 of his 2001 text book reports that postalsystems were considering schemes of this kind based on direct imaging ofenvelopes with a microscope. It is reported that an image of the paperfibres of an envelope is made, a pattern extracted, and recorded in thepostal franking mark, which is digitally signed.

U.S. Pat. No. 5,325,167[7] proposes imaging the grain structure of tonerparticles on a part of a valuable document following a similar scheme.

Through this previous work, there are various desirable features thatare apparent for an ideal verification scheme.

The reported magnetic or speckle based techniques appear to be capableof providing high security levels, but require special materials to beprepared [1, 2, 3] for practical implementation to ensure long-termstability of the probed structure [4]. In many cases, integration of atoken into the article to be secured is non-trivial. Particularly,integration of a resin token or a magnetic chip in paper or cardboard isnot easy and involves significant cost. For integration with paper orcardboard, any token should ideally be printable. Additionally, there isalso an inherent security risk of an attachable token-based approach inthat the token is potentially detachable and attachable to a differentarticle.

The reported direct imaging techniques [5, 6, 7] have the advantage thatthey obtain their digital signature directly from the article, obviatingthe need for special tokens. However, their intrinsic security is low.For example they are vulnerable to fraudulent access to the stored imagedata which may allow fabrication of an article that could be verifiedincorrectly as being authentic, or to forging by simply using a highresolution printer to print an image of what would be seen under amicroscope when viewing the relevant part of the genuine article. Thesecurity level of direct imaging techniques also scales with the volumeof the image data, forcing use of expensive high resolution imagingequipment for higher security levels. This may be acceptable in someapplications, such as postal sorting or banknote verification, but inmany applications will be unacceptable.

SUMMARY OF THE INVENTION

The invention provides a new system in which verifiable documents orother printable articles can be generated and later verified withoutdifficulty and with a high level of security. A printer with integralscanner is provided for obtaining a digital signature from a sheet ofpaper or other article as it is printed. The integral scannerilluminates the article and collects data points from coherent lightscattered from many different parts of the article as it is printed tocollect a large number of independent data points, typically 500 ormore. The digital signature derived from the data points is stored in adatabase with an image of what was printed on the article. At a latertime, the authenticity of an article purported to be the originallyprinted article can be verified by scanning the purported genuinearticle to obtain its digital signature. The database is then searchedto establish whether there is a match. If a match is found, the imagestored in the database with the matched digital signature is displayedto the user to allow a further visual check that the article is genuine.The image is displayed together with other relevant bibliographic datarelevant to the article. This provides a high security system which alsoincludes human verification in the form of the visual comparison betweenthe document or other printed article being examined and the document orother printed article shown on the display.

In this way a printer can be used normally, with each item printed beingautomatically scanned and its digital signature logged in a databasetogether with an image file of the item. Each printed item can then belater verified as being authentic or not. For example, photocopies orforgeries can be distinguished easily from an original, since thedigital signature is unique to the printed substrate, e.g. the sheet ofpaper on which has been printed.

Different aspects of the invention relate to the printing device withintegral scanner, an apparatus for creating authenticatable articlesthat is operable with the printing device, as well as an apparatus forlater verifying the authenticity of an article presented as beinggenuine or otherwise needing to be checked for its authenticity.Corresponding methods of creating authenticatable articles and verifyingthe authenticity of articles constitute further aspects of theinvention.

The invention provides in one aspect a printing device, comprising: aprint head for printing onto an article; a feed mechanism operable toconvey the article past the print head; and a scan head incorporating acoherent source and a detector arrangement, wherein the coherent sourceis arranged to direct light onto an article conveyed by the feedmechanism and a detector arrangement arranged to collect a set of datapoints from signals obtained as the light scans over the article,wherein different ones of the data points relate to scatter fromdifferent parts of the article.

The invention provides in another aspect an apparatus for creatingauthenticatable articles, comprising: a printer driver operable tocreate instructions for a printing device to print an image; a dataacquisition interface for receiving a set of data points from signalsobtained by scanning coherent light over an article during printing,wherein different ones of the data points relate to scatter of thecoherent light from different parts of the article; and a processor fordetermining a digital signature of the article from the set of datapoints and creating a record in a database, wherein the record includesthe digital signature and a representation of the image.

The invention provides in a further aspect an apparatus for verifyingthe authenticity of articles, comprising: a scanning deviceincorporating a coherent source for scanning light over an article, anda detector arrangement arranged to collect a set of data points fromsignals obtained as the light is scanned, wherein different ones of thedata points relate to scatter of the coherent light from different partsof the article; a processor for determining a digital signature of thearticle from the set of data points; a database comprising a pluralityof records of previously scanned articles, each record including thedigital signature previously determined for that article and a visualrepresentation of that article; and a signature verification moduleoperable to search the database to establish whether there is a matchbetween a digital signature obtained by the scanning device and adigital signature stored in one of the records, and, if a match isfound, to display the visual representation of the article stored in therecord with the match.

In addition the user may be presented with a confidence level of thematch, which indicates to what extent the digital signatures from theoriginal scan and the re-scan correspond. In this respect it is notedthat, the re-scanned digital signature even from a genuine item willnever match its stored database counterpart perfectly. The test of amatch or non-match is one of degree of similarity between the originallyscanned signature held in the master database and the re-scannedsignature. We find that a typical good quality match has approximately75% of the bits in agreement, compared to an average of 50% agreementfor a fraudulent match.

The database records may usefully include bibliographic data relevant tothe scanned article. Moreover, the signature verification module willdisplay the bibliographic data when a match is found. For example, inthe case of a document, the bibliographic data may include a summarydescription of the document in narrative text and an indication of thedate of creation, the creating person, and the printer i.d. of theprinter used to create the document.

The invention provides in a still further aspect a method of creatingauthenticatable articles, comprising: printing an image onto an article;scanning coherent light over the article, and collecting a set of datapoints from signals obtained as the coherent light is scattered from thearticle, wherein different ones of the data points relate to scatterfrom different parts of the article; determining a digital signature ofthe article from the set of data points; and creating a record in adatabase, wherein the record includes the digital signature and arepresentation of the image.

The invention also provides another method of creating authenticatablearticles, comprising: scanning coherent light over the article, andcollecting a set of data points from signals obtained as the coherentlight is scattered from the article, wherein different ones of the datapoints relate to scatter from different parts of the article;determining a digital signature of the article from the set of datapoints; and printing onto the article an image and a label that encodesthe digital signature according to a machine-readable encoding protocol.The label is thus characteristic of the intrinsic structure of thearticle. In this case, the signature is preferably encoded in the labelusing an asymmetric encryption algorithm. For example, the label mayrepresent a cryptogram decipherable by a public key in a publickey/private key encryption system. It is highly convenient for manyprintable materials, especially paper and cardboard, if the label is anink label applied with a printing process, preferably in the sameprocess as article creation, i.e. in the same process as printing theimage onto the document. For example, a piece of paper could be printedon with the image and then fed again through the printer to have thesignature-encoding label printed on using a duplex sheet feedingmechanism. The label may be visible, e.g. a barcode, or invisible, e.g.embodied as data in a smart chip when the article is a smart card.

The printing and scanning is conveniently performed as the article isconveyed past a print head and a scan head respectively.

The invention provides in yet a further aspect a method of verifying theauthenticity of an article, comprising: scanning coherent light over anarticle, and collecting a set of data points from signals obtained asthe coherent light is scattered from the article, wherein different onesof the data points relate to scatter from different parts of thearticle; determining a digital signature of the article from the set ofdata points; providing a database comprising a plurality of records forpreviously scanned articles, each record including the digital signaturepreviously determined for that article and a visual representation ofthat article; and searching the database to establish whether there is amatch between a digital signature obtained by the scanner and any of thedigital signatures stored in the database, and, if a match is found,displaying the visual representation of the article stored in thedatabase.

It will be appreciated that the article can be made of paper orcardboard, or any other printable substrate with a surface suitable forproviding a digital signature when scanned in the manner of theinvention. It will also be understood that references to light shouldnot be limited to visible electromagnetic radiation and includeinfra-red and ultra-violet radiation for example.

The invention is considered to be particularly useful for paper orcardboard articles from the following list of examples:

-   1. valuable documents such as share certificates, bills of lading,    passports, intergovernmental treaties, statutes, driving licenses,    vehicle roadworthiness certificates, any certificate of authenticity-   2. any document for tracing or tracking purposes, e.g. envelopes for    mail systems, banknotes for law enforcement tracking-   3. packaging of vendable products-   4. brand labels on designer goods, such as fashion items-   5. packaging of cosmetics, pharmaceuticals, or other products-   6. notarised and legalised original documents-   7. identity cards and papers.

For example, selected batches of a particular kind of printed articlemay be generated for tracing or tracking. A batch of bank notes could beprinted specifically introducing into known criminal circles, forexample to pay ransoms or bribes, or to purchase illegal drugs. Thesewould be identical to normal bank notes, but logged onto a database sothat the database not only included a unique digital signature of thebank note paper of each note, but also an image of the bank noteincluding its serial number.

It is expected that any other printable substrate material will beidentifiable by the invention provided that it has suitable surfacestructure. Material types that have very smooth surfaces at amicroscopic level may be unsuitable. Suitability of a printable materialcan be determined easily by testing some representative samples.

In one group of embodiments, the data acquisition and processing moduleis operable to further analyse the data points to identify a signalcomponent that follows a predetermined encoding protocol and to generatea reference signature therefrom. The characteristic of the predeterminedencoding protocol is envisaged to be based on contrast, i.e. scattersignal strength, in most embodiments. In particular, a conventionalbarcode protocol may be used in which the barcode is printed orotherwise applied to the article in the form of stripes in the case of a1D barcode or more complex patterns for a 2D barcode. In this case, thedata acquisition and processing module can be operable to perform acomparison to establish whether the reference signature matches thesignature obtained by reading an article that has been placed in thereading volume. Consequently, an article such as a piece of paper, canbe marked to bear a digitally signed version of its own characteristic,such as a barcode. The reference signature should be obtained from thearticle's characteristic with a one-way function, i.e. using anasymmetric encryption algorithm that requires a private key. This actsas a barrier to an unauthorised third party with a reader, who wants toread fake articles and print on them a label that represents thereader's scan according to the encryption scheme. Typically the barcodelabel or other mark would represent a cryptogram decipherable by apublic key, and the private key would be reserved for the authorisedlabellor party.

The database may be part of a mass storage device that forms part of thereader apparatus, or may be at a remote location and accessed by thereader through a telecommunications link. The telecommunications linkmay take any conventional form, including wireless and fixed links, andmay be available over the internet. The data acquisition and processingmodule may be operable, at least in some operational modes, to allow thesignature to be added to the database if no match is found. Thisfacility will usually only be allowed to authorised persons for obviousreasons.

In addition to storing the signature it is thus useful to associate thatsignature in the database with other information about the article suchas a scanned copy of the document, a photograph of a passport holder,details on the place and time of manufacture of the product, or detailson the intended sales destination of vendable goods (e.g. to track greyimportation).

The signature is envisaged to be a digital signature in mostapplications. Typical sizes of the digital signature with currenttechnology would be in the range 200 bits to 8 k bits, where currentlyit is preferable to have a digital signature size of about 2 k bits forhigh security.

BRIEF DESCRIPTION OF THE DRAWINGS

For a better understanding of the invention and to show how the same maybe carried into effect reference is now made by way of example to theaccompanying drawings in which:

FIG. 1A is a perspective view of a scan head of an embodiment of theinvention with a sheet of paper also being shown;

FIG. 1B is a side view of the scan head of FIG. 1A with a sheet ofpaper;

FIG. 2 is a schematic perspective view showing how the paper surface issampled n times over its scan area by scanning an elongate beam acrossit;

FIG. 3 is a block schematic diagram of the functional components of asystem for creating authenticatable articles;

FIG. 4 is a perspective view of a printing device with integral scanhead;

FIG. 5 shows schematically in side view an alternative imagingarrangement for a scanner embodying the invention based on directionallight collection and blanket illumination;

FIG. 6 shows schematically in plan view the optical footprint of afurther alternative imaging arrangement for a scanner embodying theinvention in which directional detectors are used in combination withlocalised illumination with an elongate beam;

FIG. 7 is a microscope image of a paper surface with the image coveringan area of approximately 0.5×0.2 mm;

FIG. 8A shows raw data from a single photodetector using the scan headof FIG. 1A which consists of a photodetector signal and an encodersignal;

FIG. 8B shows the photodetector data of FIG. 8A after linearisation withthe encoder signal and averaging the amplitude;

FIG. 8C shows the data of FIG. 8B after digitisation according to theaverage level;

FIG. 9 is a flow diagram showing how a digital signature of an articleis generated from a scan;

FIG. 10 is a flow diagram showing a printing process during which thepaper being printed on is scanned and its digital signature computed andstored in a database;

FIG. 11 is a schematic side view of a reader apparatus for scanningarticles for verification;

FIG. 12 is a block schematic diagram of the functional components of thereader apparatus of FIG. 11 and associated system components;

FIG. 13 is a perspective view of the reader apparatus of FIG. 11 showingits external form;

FIG. 14 is a flow diagram showing how a digital signature of an articleobtained from a scan can be verified against a database in which thedigital signatures of previously scanned articles are stored;

FIG. 15 is a flow diagram showing the overall process of how a documentis scanned for verification purposes and the results presented to auser;

FIG. 16 is a screen shot of the user interface displayed when are-scanned document is verified as being authentic;

FIG. 17 is a schematic plan view of an ID card bearing a barcode labelthat encodes a digital signature obtained from an intrinsic measuredsurface characteristic;

FIG. 18 is a schematic plan view of an ID card with a chip carrying datathat encodes a digital signature obtained from an intrinsic measuredsurface characteristic; and

FIG. 19 is a schematic plan view of a warranty document bearing twobarcode labels that encode a digital signature obtained from anintrinsic measured surface characteristic.

DETAILED DESCRIPTION

FIGS. 1A and 1B are schematic representations in perspective and sideview respectively of a scan head 10 of an embodiment of the invention.The scan head 10 is for measuring a digital signature from a piece ofpaper 5 or other printable article which is conveyed past the scan head10 in the x-direction through its reading volume (see inset axes in thedrawing). The principal optical components are a laser source 14 forgenerating a coherent laser beam 15 and a detector arrangement 16 madeup of a plurality of k photodetector elements, where k=4 in thisexample, labelled 16 a, 16 b, 16 c and 16 d. The laser beam 15 isfocused by a cylindrical lens 18 into an elongate focus extending in they direction (perpendicular to the plane of the drawing) and lying in theplane of the paper path. In an example prototype, the elongate focus hasa major axis dimension of about 2 mm and a minor axis dimension of about40 micrometers. These optical components are contained in a mountingblock 11. In the illustrated embodiment, the four detector elements 16 a. . . d are distributed either side of the beam axis offset at differentangles in an interdigitated arrangement from the beam axis to collectlight scattered in reflection from an article present in the readingvolume. In an example prototype, the offset angles are −70, −20, +30 and+50 degrees. Light access to the detector elements 16 a . . . d isprovided by through holes in the mounting block 11. The angles eitherside of the beam axis are chosen so as not to be equal so that the datapoints they collect are as independent as possible. All four detectorelements are arranged in a common plane. The photodetector elements 16 a. . . d detect light scattered from the surface of paper 5 beingconveyed past the scan head 10 when the coherent beam scatters from thepaper 5. As illustrated, the source is mounted to direct the laser beam15 with its beam axis in the z direction, so that it will strike thepaper 5 at normal incidence.

Generally it is desirable that the depth of focus is large, so that anydifferences in the paper positioning in the z direction do not result insignificant changes in the size of the beam incident on the paper. In anexample prototype, the depth of focus is approximately 0.5 mm which issufficiently large to produce good results. The parameters, of depth offocus, numerical aperture and working distance are interdependent,resulting in a well known trade off between spot size and depth offocus.

When the scan head 10 is integrated into an otherwise conventionalprinter, the paper feed mechanism will serve to move the paper linearlyin the x direction past the scan head 10 so that the beam 15 is scannedin a direction transverse to the major axis of the elongate focus. Sincethe coherent beam 15 is dimensioned at its focus to have a cross-sectionin the xz plane (plane of the drawing) that is much smaller than aprojection of the reading volume in a plane normal to the coherent beam,i.e. in the plane of the paper 5, the paper feed will cause the coherentbeam 15 to sample many different parts of the paper.

FIG. 2 is included to illustrate this sampling and is a schematicperspective view showing how the reading area is sampled n times byscanning an elongate beam across it. The sampling positions of thefocused laser beam as it is scanned over the paper under action of thepaper feed is represented by the adjacent rectangles numbered 1 to nwhich sample an area of length ‘1’ and approximate width ‘w’, where ‘w’is the long dimension of the cylindrical focus. Data collection is madeso as to collect signal at each of the n positions as the paper isconveyed past the scan head. Consequently, a sequence of k×n data pointsare collected that relate to scatter from the n different illustratedparts of the paper. Typically, only a portion of the paper's length willbe sampled. For example, length ‘1’ may be approximately a fewcentimeters.

With an example minor dimension of the focus of 40 micrometers, and ascan length in the x direction of 2 cm, n=500, giving 2000 data pointswith k=4. A typical range of values for k×n depending on desiredsecurity level, article type, number of detector channels ‘k’ and otherfactors is expected to be 100<k×n<10,000. It has also been found thatincreasing the number of detectors k also improves the insensitivity ofthe measurements to surface degradation of the article through handling,printing etc. In practice, with the prototypes used to date, a rule ofthumb is that the total number of independent data points, i.e. k×n,should be 500 or more to give an acceptably high security level with awide variety of surfaces.

FIG. 3 is a block schematic diagram of the functional components of asystem for creating authenticatable articles. A printer 22 is connectedto a personal computer (PC) 30 with a conventional connection 25. Thedetectors 16 a . . . d of the detector module 16 are connected throughrespective electrical connection lines 17 a . . . d to ananalogue-to-digital converter (ADC) that is part of a programmableinterrupt controller (PIC) 30. It will be understood that optical orwireless links may be used instead of, or in combination with,electrical links. The PIC 30 is interfaced with a personal computer (PC)34 through a serial connection 32. The PC 34 may be a desktop or alaptop. As an alternative to a PC, other intelligent devices may beused, for example a personal digital assistant (PDA) or a dedicatedelectronics unit. The PIC 30 and PC 34 collectively form a dataacquisition and processing module 36 for determining a signature of thearticle from the set of data points collected by the detectors 16 a . .. d. The PC 34 has access through an interface connection 38 to adatabase (dB) 40. The database 40 may be resident on the PC 34 inmemory, or stored on a drive thereof. Alternatively, the database 40 maybe remote from the PC 34 and accessed by wireless communication, forexample using mobile telephony services or a wireless local area network(LAN) in combination with the internet. Moreover, the database 40 may bestored locally on the PC 34, but periodically downloaded from a remotesource.

The database 40 is for compiling a library of digital signatures. The PC34 is programmed so that in use it obtains scan data from the detectors16 a . . . d each time a document is printed out by the printer 22 andfrom this data computes a digital signature. A new record is thencreated in the database 40 containing the digital signature, an imagefile of what has been printed on the piece of paper and alsobibliographic data relevant to the document.

FIG. 4 is a perspective view of a printer 22 with the above-describedscan head 10 integrated into it. The printer 22 is conventional otherthan by virtue of the scan head and associated electronics. Toschematically represent the paper feed mechanism the final roller pair 9thereof is shown. It will be appreciated that the paper feed mechanismincludes additional rollers and other mechanical parts. In the prototypebuilt already, the scan head is for convenience mounted as illustrateddirectly after the final roller paper. It will be appreciated that thescan head could be mounted in many different positions along the feedpath of the paper. Moreover, although the illustration is of a laserprinter, it will be appreciated that any kind of printing device couldbe used. As well as other forms of printer, such as inkjet printers orthermal printers, the printing device could be any other kind ofprinting device not conventionally regarded as a printer, such as anetworked photocopier machine, or an industrial printing press. Forexample, the printing device could be a printing press for printing banknotes, cheques, or travellers cheques.

The above-described embodiments are based on localised excitation with acoherent light beam of small cross-section in combination with detectorsthat accept light signal scattered over a much larger area that includesthe local area of excitation. It is possible to design a functionallyequivalent optical system which is instead based on directionaldetectors that collect light only from localised areas in combinationwith excitation of a much larger area.

FIG. 5 shows schematically in side view such an imaging arrangement fora reader embodying the invention which is based on directional lightcollection and blanket illumination with a coherent beam. An arraydetector 48 is arranged in combination with a cylindrical microlensarray 46 so that adjacent strips of the detector array 48 only collectlight from corresponding adjacent strips along the paper 5. Withreference to FIG. 2, each cylindrical microlens is arranged to collectlight signal from one of the n sampling strips. The coherentillumination can then take place with blanket illumination of the wholearea being sampled (not shown in the illustration).

A hybrid system with a combination of localised excitation and localiseddetection may also be useful in some cases.

FIG. 6 shows schematically in plan view the optical footprint of such ahybrid imaging arrangement for a scanner embodying the invention inwhich directional detectors are used in combination with localisedillumination with an elongate beam. This embodiment may be considered tobe a development of the embodiment of FIGS. 1A & 1B in which directionaldetectors are provided. In this embodiment three banks of directionaldetectors are provided, each bank being targeted to collect light fromdifferent portions along the ‘1×w’ excitation strip. The collection areafrom the plane of the reading volume are shown with the dotted circles,so that a first bank of, for example 2, detectors collects light signalfrom the upper portion of the excitation strip, a second bank ofdetectors collects light signal from a middle portion of the excitationstrip and a third bank of detectors collects light from a lower portionof the excitation strip. Each bank of detectors is shown having acircular collection area of diameter approximately 1/m, where m is thenumber of subdivisions of the excitation strip, where m=3 in the presentexample. In this way the number of independent data points can beincreased by a factor of m for a given scan length 1. As describedfurther below, one or more of different banks of directional detectorscan be used for a purpose other than collecting light signal thatsamples a speckle pattern. For example, one of the banks may be used tocollect light signal in a way optimised for barcode scanning in the casethat a barcode is printed, for example to encode some aspect of thedocument, such as its bibliographic data. If this is the case it willgenerally be sufficient for that bank to contain only one detector,since there will be no advantage obtaining cross-correlations when onlyscanning for contrast.

Having now described the principal structural components and functionalcomponents of various apparatuses suitable for carrying out theinvention, the numerical processing used to determine a digitalsignature is now described. It will be understood that this numericalprocessing is implemented for the most part in a computer program thatruns on the PC 34 with some elements subordinated to the PIC 30.

FIG. 7 is a microscope image of a paper surface with the image coveringan area of approximately 0.5×0.2 mm. This figure is included toillustrate that macroscopically flat surfaces, such as from paper, arein many cases highly structured at a microscopic scale. For paper, thesurface is microscopically highly structured as a result of theintermeshed network of wood fibres that make up paper. The figure isalso illustrative of the characteristic length scale for the wood fibreswhich is around 10 microns. This dimension has the correct relationshipto the optical wavelength of the coherent beam to cause diffraction andhence speckle, and also diffuse scattering which has a profile thatdepends upon the fibre orientation. It will thus be appreciated that ifa scan head is to be designed for a specific class of printablesubstrate material, the wavelength of the laser can be tailored to thestructure feature size of the class of material to be scanned. It isalso evident from the figure that the local surface structure of eachpiece of paper will be unique in that it depends on how the individualwood fibres are arranged. A piece of paper is thus no different from aspecially created token, such as the special resin tokens or magneticmaterial deposits of the prior art, in that it has structure which isunique as a result of it being made by a process governed by laws ofnature. The same applies to many other types of article.

In other words, the inventor has discovered that it is essentiallypointless to go to the effort and expense of making specially preparedtokens, when unique characteristics are measurable in a straightforwardmanner from a wide variety of every day articles. The data collectionand numerical processing of a scatter signal that takes advantage of thenatural structure of an article's surface (or interior in the case oftransmission) is now described.

FIG. 8A shows raw data from a single one of the photodetectors 16 a . .. d of the scan head of FIG. 1A. The graph plots signal intensity I inarbitrary units (a.u.) against point number n (see FIG. 2). The highertrace fluctuating between I=0-250 is the raw signal data fromphotodetector 16 a. The lower trace is the encoder signal picked up fromthe markers 28 (see FIG. 2) which is at around I=50.

FIG. 8B shows the photodetector data of FIG. 8A after linearisation withthe encoder signal (n.b. although the x axis is on a different scalefrom FIG. 8A, this is of no significance). In addition, the average ofthe intensity has been computed and subtracted from the intensityvalues. The processed data values thus fluctuate above and below zero.

FIG. 8C shows the data of FIG. 8B after digitisation. The digitisationscheme adopted is a simple binary one in which any positive intensityvalues are set at value 1 and any negative intensity values are set atzero. It will be appreciated that multi-state digitisation could be usedinstead, or any one of many other possible digitisation approaches. Themain important feature of the digitisation is merely that the samedigitisation scheme is applied consistently.

FIG. 9 is a flow diagram showing how a signature of an article isgenerated from a scan.

Step S1 is a data acquisition step during which the optical intensity ateach of the photodetectors is acquired approximately every 1 ms duringthe entire length of scan. Simultaneously, the encoder signal isacquired as a function of time. It is noted that if the paper feedmechanism has a high degree of linearisation accuracy then linearisationof the data may not be required. The data is acquired by the PIC 30taking data from the ADC 31. The data points are transferred in realtime from the PIC 30 to the PC 34. Alternatively, the data points couldbe stored in memory in the PIC 30 and then passed to the PC 34 at theend of a scan. The number n of data points per detector channelcollected in each scan is defined as N in the following. Further, thevalue a_(k)(i) is defined as the i-th stored intensity value fromphotodetector k, where i runs from 1 to N. Examples of two raw data setsobtained from such a scan are illustrated in FIG. 8A.

Step S2 uses numerical interpolation to locally expand and contracta_(k)(i) so that the encoder transitions are evenly spaced in time. Thiscorrects for local variations in the motor speed. This step is performedin the PC 34 by a computer program.

Step S3 is an optional step. If performed, this step numericallydifferentiates the data with respect to time. It may also be desirableto apply a weak smoothing function to the data. Differentiation may beuseful for highly structured surfaces, as it serves to attenuateuncorrelated contributions from the signal relative to correlated(speckle) contributions.

Step S4 is a step in which, for each photodetector, the mean of therecorded signal is taken over the N data points. For each photodetector,this mean value is subtracted from all of the data points so that thedata are distributed about zero intensity. Reference is made to FIG. 8Bwhich shows an example of a scan data set after linearisation andsubtraction of a computed average.

Step S5 digitises the analogue photodetector data to compute a digitalsignature representative of the scan. The digital signature is obtainedby applying the rule: a_(k)(i)>0 maps onto binary ‘1’ and a_(k)(i)<=0maps onto binary ‘0’. The digitised data set is defined as d_(k)(i)where i runs from 1 to N. The signature of the article mayadvantageously incorporate further components in addition to thedigitised signature of the intensity data just described. These furtheroptional signature components are now described.

Step S6 is an optional step in which a smaller ‘thumbnail’ digitalsignature is created. This is done either by averaging together adjacentgroups of in readings, or more preferably by picking every cth datapoint, where c is the compression factor of the thumbnail. The latter ispreferred since averaging may disproportionately amplify noise. The samedigitisation rule used in Step S5 is then applied to the reduced dataset. The thumbnail digitisation is defined as t_(k)(i) where i runs 1 toN/c and c is the compression factor.

Step S7 is an optional step applicable when multiple detector channelsexist. The additional component is a cross-correlation componentcalculated between the intensity data obtained from different ones ofthe photodetectors. With 2 channels there is one possiblecross-correlation coefficient, with 3 channels up to 3, and with 4channels up to 6 etc. The cross-correlation coefficients are useful,since it has been found that they are good indicators of material type.For example, for a particular type of document, such as a passport of agiven type, or laser printer paper, the cross-correlation coefficientsalways appear to lie in predictable ranges. A normalisedcross-correlation can be calculated between a_(k)(i) and a_(l)(i), wherek≠1 and k,l vary across all of the photodetector channel numbers. Thenormalised cross-correlation function Γ is defined as

${\Gamma\left( {k,l} \right)} = \frac{\sum\limits_{i = 1}^{N}{{a_{k}(i)}{a_{l}(i)}}}{\sqrt{\left( {\sum\limits_{i = 1}^{N}{a_{k}(i)}^{2}} \right)\left( {\sum\limits_{i = 1}^{N}{a_{l}(i)}^{2}} \right)}}$

The use of the cross-correlation coefficients in verification processingis described further below.

Step S8 is another optional step which is to compute a simple intensityaverage value indicative of the signal intensity distribution. This maybe an overall average of each of the mean values for the differentdetectors or an average for each detector, such as a root mean square(rms) value of a_(k)(i). If the detectors are arranged in pairs eitherside of normal incidence as in the reader described above, an averagefor each pair of detectors may be used. The intensity value has beenfound to be a good crude filter for material type, since it is a simpleindication of overall reflectivity and roughness of the sample. Forexample, one can use as the intensity value the unnormalised rms valueafter removal of the average value, i.e. the DC background.

The digital signature data obtained from scanning an article can then bewritten to the database by adding a new record together with an imagefile of what has been printed onto the substrate and associatedbibliographic data. A new database record will include the digitalsignature obtained in Step S5 as well as optionally its smallerthumbnail version obtained in Step S6 for each photodetector channel,the cross-correlation coefficients obtained in Step S7 and the averagevalue(s) obtained in Step S8. Alternatively, the thumbnails may bestored on a separate database of their own optimised for rapidsearching, and the rest of the data (including the thumbnails) on a maindatabase. It is noted that the same process can be used when obtaining adigital signature for verification purposes subsequently as is describedfurther below.

FIG. 10 is a flow diagram showing a printing process during which thepaper being printed on is scanned and its digital signature computed andstored in a database. A user of the PC 30 prepares a document forprinting using a word processor, drawing package or other type ofapplication software for creating documents. Once the document is ready,a print command is issued. An image file is then created by theapplication software using an appropriate printer driver. This imagefile is then sent to the printer for printing. As the paper on which theimage is being printed is being fed through the printer, the scan headscans a portion of the paper. The scatter signals thus collected areconverted into data points as described above and a digital signature iscomputed according the process described above with reference to FIG. 9.A database record is then created to store not only the digitalsignature, but also the image file and relevant bibliographic datarelating to the document creation.

It is noted that it is convenient to store the image file created by theprinter driver, but that is not the only possibility. The image filecould be another file type derived from the printer driver image file,or an image file in a preferred format of the application software usedto create the document, or another format created by the applicationsoftware. Another possibility would be for the image file to be derivedfrom a rescan of the document after printing. For example, this could bedone automatically in a printing device in the format of a networkedphotocopier machine that has sophisticated paper feed (and re-feed)options and an integrated document scanner. In this case, the imagerepresentation stored in the database would include any features on thesubstrate as well as what was printed on the substrate. For example, ifthe paper is headed paper, the header would be included. This may beadvantageous in some circumstances. A wide variety of solutions ispossible. All that is important is to store some kind of visualrepresentation of what has been printed.

The above text describes how documents are scanned at source inside aprinting device whenever they are generated in order to obtain a digitalsignature unique to the paper or other substrate on which somerepresentation has been printed, and the digital signature stored in adatabase together with a representation of what has been printed.

The following text describes how documents generated in this way canlater be verified as authentic, or alternatively how documents can betested to establish whether they have been generated by the authorisedsource.

FIG. 11 is a schematic side view of a portable scanner or readerapparatus 1 for re-scanning documents or other articles for verificationpurposes. The optical design is largely the same as for the scan head ofFIG. 1A fitted in a printer as is evident. The same reference numeralsfor corresponding components have been used for ease of comparison. Theprincipal difference between the two designs is that the scanner of FIG.11 moves the scan head and keeps the article static, while theprinter-based scanner described above moves the paper past the staticscan head.

The optical reader apparatus 1 is for measuring a signature from anarticle (not shown) arranged in a reading volume of the apparatus. Thereading volume is formed by a reading aperture 7 which is a slit in ahousing 12. The housing 12 contains the main optical components of theapparatus. The slit has its major extent in the x direction (see insetaxes in the drawing). The principal optical components are a lasersource 14 for generating a coherent laser beam 15 and a detectorarrangement 16 made up of a plurality of k photodetector elements, wherek=4 in this example, labelled 16 a, 16 b, 16 c and 16 d. The laser beam15 is focused by a cylindrical lens 18 into an elongate focus extendingin the y direction (perpendicular to the plane of the drawing) and lyingin the plane of the reading aperture. In an example prototype reader,the elongate focus has a major axis dimension of about 2 mm and a minoraxis dimension of about 40 micrometers. These optical components arecontained in a scan head subassembly 20. Further details of the opticaldesign are as described above in relation to FIGS. 1A and 1B inparticular, so are not repeated here.

A drive motor 22 is arranged in the housing 12 for providing linearmotion of the optics subassembly 20 via suitable bearings 24 or othermeans, as indicated by the arrows 26. The drive motor 22 thus serves tomove the coherent beam linearly in the x direction over the readingaperture 7 so that the beam 15 is scanned in a direction transverse tothe major axis of the elongate focus.

The sampling is as described above in relation to the printer scanner,i.e. as illustrated in FIG. 2, so is not repeated here.

FIG. 12 is a block schematic diagram of the functional components of thereader apparatus. The motor 22 is connected to a programmable interruptcontroller (PIC) 30 through an electrical link 23. The detectors 16 a .. . d of the detector module 16 are connected through respectiveelectrical connection lines 17 a . . . d to an analogue-to-digitalconverter (ADC) that is part of the PIC 30. It will be understood thatoptical or wireless links may be used instead of, or in combinationwith, electrical links. The PIC 30 is interfaced with a personalcomputer (PC) 34 through a serial connection 32. The PC 34 may be adesktop or a laptop. As an alternative to a PC, other intelligentdevices may be used, for example a personal digital assistant (PDA) or adedicated electronics unit. The PIC 30 and PC 34 collectively form adata acquisition and processing module for determining a signature ofthe article from the set of data points collected by the detectors 16 a. . . d. The PC 34 has access through an interface connection 38 to adatabase (dB) 40. The database 40 may be resident on the PC 34 inmemory, or stored on a drive thereof. Alternatively, the database 40 maybe remote from the PC 34 and accessed by wireless communication, forexample using mobile telephony services or a wireless local area network(LAN) in combination with the internet. Moreover, the database 40 may bestored locally on the PC 34, but periodically downloaded from a remotesource.

The database 40 contains a library of previously recorded signatures.The PC 34 is programmed so that in use it accesses the database 40 andperforms a comparison to establish whether the database 40 contains amatch to the signature of the article that has been placed in thereading volume.

FIG. 13 is a perspective view of the reader apparatus 1 showing itsexternal form. The housing 12 and slit-shaped reading aperture 7 areevident. A physical location aid 42 is also apparent and is provided forpositioning an article of a given form in a fixed position in relationto the reading aperture 7. In the illustrated example, the physicallocation aid 42 is in the form of a right-angle bracket in which thecorner of a document or packaging box can be located. This ensures thatthe same part of the article can be positioned in the reading aperture 7whenever the article needs to be scanned. A simple angle bracket orequivalent, is sufficient for articles with a well-defined corner, suchas sheets of paper, passports, ID cards and packaging boxes.

For packaging boxes, an alternative to the slit aperture would be toprovide a suitable guide hole, for example a rectangular cross-sectionhole for accepting the base of a rectangular box or a circularcross-section hole for accepting the base of a tubular box (i.e.cylindrical box).

FIG. 14 is a flow diagram showing how a signature of an article obtainedfrom a scan can be verified against a signature database.

In a simple implementation, the database could simply be searched tofind a match based on the full set of signature data. However, to speedup the verification process, the process preferably uses the smallerthumbnails and pre-screening based on the computed average values andcross-correlation coefficients as now described.

The verification process takes place after scanning an article accordingto the process described above, i.e. to perform Scan Steps S1 to S8illustrated in FIG. 9.

Verification Step V1 takes each of the thumbnail entries and evaluatesthe number of matching bits between it and t_(k)(i+j), where j is a bitoffset which is varied to compensate for errors in placement of thescanned area. The value of j is determined and then the thumbnail entrywhich gives the maximum number of matching bits. This is the ‘hit’ usedfor further processing.

Verification Step V2 is an optional pre-screening test that is performedbefore analysing the full digital signature stored for the recordagainst the scanned digital signature. In this pre-screen, the rmsvalues obtained in Scan Step S8 are compared against the correspondingstored values in the database record of the hit. The ‘hit’ is rejectedfrom further processing if the respective average values do not agreewithin a predefined range. The article is then rejected as non-verified(i.e. jump to end and issue fail result).

Verification Step V3 is a further optional pre-screening test that isperformed before analysing the full digital signature. In thispre-screen, the cross-correlation coefficients obtained in Scan Step S7are compared against the corresponding stored values in the databaserecord of the hit. The ‘hit’ is rejected from further processing if therespective cross-correlation coefficients do not agree within apredefined range. The article is then rejected as non-verified (i.e.jump to end and issue fail result).

Verification Step V4 is the main comparison between the scanned digitalsignature obtained in Scan Step S5 and the corresponding stored valuesin the database record of the hit. The full stored digitised signature,d_(k) ^(db)(i) is split into n blocks of q adjacent bits on k detectorchannels, i.e. there are qk bits per block. A typical value for q is 4and a typical value for k is 4, making typically 16 bits per block. Theqk bits are then matched against the qk corresponding bits in the storeddigital signature d_(k) ^(db)(i+j). If the number of matching bitswithin the block is greater or equal to some pre-defined thresholdz_(thresh), then the number of matching blocks is incremented. A typicalvalue for z_(thresh) is 13. This is repeated for all n blocks. Thiswhole process is repeated for different offset values of j, tocompensate for errors in placement of the scanned area, until a maximumnumber of matching blocks is found. Defining M as the maximum number ofmatching blocks, the probability of an accidental match is calculated byevaluating:

${p(M)} = {\sum\limits_{w = {n - M}}^{n}{{s^{w}\left( {1 - s} \right)}^{n - w}{\,_{w}^{n}C}}}$where s is the probability of an accidental match between any two blocks(which in turn depends upon the chosen value of z_(threshold)), M is thenumber of matching blocks and p(M) is the probability of M or moreblocks matching accidentally. The value of is determined by comparingblocks within the data base from scans of different objects of similarmaterials, e.g. a number of scans of paper documents etc. For the caseof q=4, k=4 and z_(threshold)=13, we find a typical value of s is 0.1.If the qk bits were entirely independent, then probability theory wouldgive s=0.01 for z_(threshold)=13. The fact that we find a higher valueempirically is because of correlations between the k detector channelsand also correlations between adjacent bits in the block due to a finitelaser spot width. A typical scan of a piece of paper yields around 314matching blocks out of a total number of 510 blocks, when comparedagainst the data base entry for that piece of paper. Setting M=314,n=510, s=0.1 for the above equation gives a probability of an accidentalmatch of 10⁻¹⁷⁷.

Verification Step V5 issues a result of the verification process. Theprobability result obtained in Verification Step V4 may be used in apass/fail test in which the benchmark is a pre-defined probabilitythreshold. In this case the probability threshold may be set at a levelby the system, or may be a variable parameter set at a level chosen bythe user. Alternatively, the probability result may be output to theuser as a confidence level, either in raw form as the probabilityitself, or in a modified form using relative terms (e.g. no match/poormatch/good match/excellent match) or other classification.

It will be appreciated that many variations are possible. For example,instead of treating the cross-correlation coefficients as a pre-screencomponent, they could be treated together with the digitised intensitydata as part of the main signature. For example the cross-correlationcoefficients could be digitised and added to the digitised intensitydata. The cross-correlation coefficients could also be digitised ontheir own and used to generate bit strings or the like which could thenbe searched in the same way as described above for the thumbnails of thedigitised intensity data in order to find the hits.

FIG. 15 is a flow diagram showing the overall process of how a documentis scanned for verification purposes and the results presented to auser. First the document is scanned using the scanning system of FIGS.11 to 13. The document authenticity is then verified using the processof FIG. 14. If there is no matching record in the database, a “no match”result is displayed to the user. If there is a match, this is displayedto the user in the form now described.

FIG. 16 is a screen shot of the user interface displayed when are-scanned document is verified as being authentic. In the mainright-hand window, a visual representation of the document stored in thedatabase record with the matching digital signature is presented. Thisis an electronic copy of the document associated with the matchingdigital signature. In the figure, this document is a letter formallyoffering a loan. Another example would be the photograph page of apassport, but it will be appreciated there are limitless examples. Onthe left side of the screen a confidence level indicator bar. This is agraphic indicator of the probability result, as described with referenceto FIG. 14. The bar is labelled left-to-right with“Poor-Normal-Good-Excellent” as a relative indicator of match quality.There is also shown some bibliographic data, namely in the large textwindow some narrative text descriptive of the document is displayed.This could be automatically generated at source, for example when theapplication software environment includes a document management system.A smaller text window displays bibliographic data identifying theprinter on which the document was generated, the user i.d. of the userwho generated it, and the generation date/time. Database statistics canalso be shown, such as the record number as illustrated in the bottomleft corner of the screen.

It will thus be appreciated that when a database match is found the useris presented with relevant information in an intuitive and accessibleform to allow the user to apply his or her own common sense for anadditional, informal layer of verification. Clearly, the document imageshould look like the document presented to the verifying person, andother factors will be of interest such as the confidence level andbibliographic data relating to document origin. The verifying personwill be able to apply their experience to make a value judgement as towhether these various pieces of information are self consistent.

A further implementation of the invention is now described.

FIG. 17 shows an ID card 50 bearing a barcode. The ID card may also bearan independent security element 54 such as a photograph, hologram orcontain some biometric information specific to an individual. Thebarcode is shown as part of a scan area 56. This is illustrated with adashed line, since it is featureless on the ID card. The scan area issubdivided between a lower area 52 containing the barcode and a blankupper area 58. The ID card 50 is designed to be scanned by a readerapparatus of the kind illustrated in FIG. 6, where one of thedirectional detector banks is used to scan the barcode area 52 and theother two banks to scan the upper area 58. In this embodiment, thebarcode encodes the signature obtained by scanning the blank upper areausing the method of the invention.

In other words, the barcode was originally applied at the time ofmanufacture of the ID card by scanning the blank upper area of the cardaccording to the method of the invention and then printing the barcodeonto the lower area 52. The ID card is thus labelled with a signaturecharacteristic of its intrinsic structure, namely the surface structurein the upper area 58.

It will be appreciated that this basic approach can be used to mark awide variety of articles with a label that encodes the articles ownsignature obtained from its intrinsic physical properties, for exampleany printable article, including paper or cardboard articles or plasticarticles.

Given the public nature of the barcode or other label that follows apublicly known encoding protocol, it is advisable to make sure that thesignature has been transformed using an asymmetric encryption algorithmfor creation of the barcode, i.e. a one-way function is used, such asaccording to the well known RSA algorithm. A preferred implementation isfor the label to represent a public key in a public key/private keyencryption system. If the system is used by a number of differentcustomers, it is advisable that each customer has its own private key,so that disclosure of a private key will only affect one customer. Thelabel thus encodes the public key and the private key is locatedsecurely with the authorised persons.

In an embodiment, a printing device with a duplex sheet feeder is used,which allows a sheet of paper to pass through it twice. This may be onceon each side for two-sided printing, or twice on the same side forprinting twice on the same side. The first pass is used to acquire theunique digital signature from the sheet using the scan head integratedin the printing device. The second pass then immediately prints abarcode, or other encoding label, containing an encrypted version of thedigital signature onto the paper. This gives the possibility of ‘withoutdatabase’ checks on the document, although clearly the stored image ofthe document could not be checked without reference to a database. It isalso possible to add other information to the bare ode. A specificexample of where this might be useful is in printing of cheques. Thevalue of the cheque and optionally also a hash of the drawer's namecould be included in the barcode.

In another embodiment, the paper or other printable article is scannedfirst to allow the digital signature to be determined before anyprinting takes place. The printing of the image and the barcode encodingthe digital signature can then take place in one printing action.

It will be further understood that the barcode or other label could alsobe used to encode other information, either ancillary to the digitalsignature or unrelated to the digital signature.

A further perceived advantage of the labelling approach is that a noviceuser would be unaware of the verification being carried out withoutspecial knowledge. It would be natural for the user to assume that thereader apparatus was simply a barcode scanner, and it was the barcodethat was being scanned.

The labelling scheme could be used to allow articles to be verifiedwithout access to a database purely on the basis of the label. This is asimilar approach conceptually to the failed banknote scheme reported inthe prior art [4].

However, it is also envisaged that the labelling scheme could be used incombination with a database verification scheme. For example, thebarcode could encode a thumbnail form of the digital signature and beused to allow a rapid pre-screen prior to screening with reference to adatabase. This could be a very important approach in practice, sincepotentially in some database applications, the number of records couldbecome huge (e.g. millions) and searching strategies would becomecritical. Intrinsically high speed searching techniques, such as the useof bitstrings, could become important

As an alternative to the barcode encoding a thumbnail, the barcode (orother label) could encode a record locator, i.e. be an index orbookmark, which can be used to rapidly find the correct signature in thedatabase for further comparison.

Another variant is that the barcode (or other label) encodes a thumbnailsignature which can be used to get a match with reasonable but not highconfidence if a database is not available (e.g. temporarily off-line, orthe scanning is being done in an unusually remote location withoutinternet access). That same thumbnail can then be used for rapid recordlocating within the main database if the database is available, allowinga higher confidence verification to be performed.

FIG. 18 is a schematic plan view of an ID card 50 which is a so-calledsmart card that incorporates a data carrying chip 54. The data carriedby the chip 54 includes signature encoding data that encodes a digitalsignature obtained from an intrinsic measured surface characteristic ofthe ID card 50 obtained from a scan area 56 which is featureless in thisexample as indicated by the dotted lines, but could be decorated in anydesired way, or contain a photograph, for example.

FIG. 19 is a schematic plan view of a warranty document 50. The scanarea 56 includes two barcode labels 52 a, 52 b arranged one above theother which encode a digital signature obtained from an intrinsicmeasured surface characteristic, similar to the ID card example of FIG.17. The barcodes 52 a, 52 b are arranged above and below a digitalsignature scan area 58 for a person's signature 59 as schematicallyillustrated. The area 58 at least is preferably covered with atransparent adhesive covering for tamper protection.

Many other commercial examples will be envisaged, the above FIGS. 17 to19 given by way of example only.

From the above detailed description it will be understood how an articlemade of a printable material, such as paper or cardboard, or plastic,can be created and identified by exposing the material to coherentradiation, collecting a set of data points that measure scatter of thecoherent radiation from intrinsic structure of the material, anddetermining a signature of the article from the set of data points.

It will also be understood that the scan area is essentially arbitraryin terms of its size or location on the printable surface of an article.If desired, the scan could be a linear scan rastered to cover a largertwo-dimensional area, for example.

Moreover, it will be understood how this can be applied to identify aproduct by its packaging, a document or an item of printable clothing,by exposing the article to coherent radiation, collecting a set of datapoints that measure scatter of the coherent radiation from intrinsicstructure of the article, and determining a signature of the productfrom the set of data points.

From the above description of the numerical processing, it will beunderstood that degradation of the beam localisation (e.g. beamcross-section enlargement in the reading volume owing to sub-optimumfocus of the coherent beam) will not be catastrophic to the system, butmerely degrade its performance by increasing the accidental matchprobability. The apparatus is thus robust against apparatus variationsgiving a stable gradual degradation in performance rather than a suddenunstable failure. In any case, it is simple to perform a self test of areader, thereby picking up any equipment problems, by performing anautocorrelation on the collected data to ascertain the characteristicminimum feature size in the response data.

A further security measure that can be applied to paper or cardboard,for example, is to adhesively bond a transparent seal (e.g. adhesivetape) over the scanned area. The adhesive is selected to be sufficientlystrong that its removal will destroy the underlying surface structurewhich it is essential to preserve in order to perform a verificationscan. The same approach can be applied to deposition of transparentpolymer or plastic films on a card, or its encapsulation with similarmaterials.

As described above, the reader may be embodied in an apparatus designedspecifically to implement the invention. In other cases, the reader willbe designed by adding appropriate ancillary components to an apparatusprincipally designed with another functionality in mind, such as aphotocopier machine, document scanner, document management system, POSdevice, ATM, air ticket boarding card reader or other device.

Many other variations of the invention will be envisaged by the skilledperson in addition to those specifically mentioned above.

It will be appreciated that although particular embodiments of theinvention have been described, many modifications/additions and/orsubstitutions may be made within the spirit and scope of the presentinvention.

REFERENCES

-   [1] PCT/GB03/03917—Cowburn-   [2] GB 2 221 870 A—Ezra, Hare & Pugsley-   [3] U.S. Pat. No. 6,584,214—Pappu, Gershenfeld & Smith-   [4] Kravolec “Plastic tag makes foolproof ID” Technology Research    News, 2 Oct. 2002-   [5] R Anderson “Security Engineering: a guide to building dependable    distributed systems” Wiley 2001, pages 251-252 ISBN 0-471-38922-6-   [6] U.S. Pat. No. 5,521,984-   [7] U.S. Pat. No. 5,325,167

The invention claimed is:
 1. An apparatus for creating authenticatablearticles, comprising: a printer driver that creates instructions for aprinting device to print an image; a data acquisition interface thatreceives a set comprising groups of data points from a printing devicecomprising: a feed mechanism that conveys an article through theprinting device; and a scan head that scans an article conveyed throughthe printing device by the feed mechanism, the scan head comprising: acoherent source that emits light as an article is conveyed past the scanhead by the feed mechanism so as to sequentially illuminate a pluralityof regions of an article; and a detector arrangement that detects lightscattered from surface structure of the article so as to collect a setcomprising groups of data points wherein each of the groups of datapoints relates to scatter caused by surface structure from therespective different regions of the surface of the article; and aprocessor that processes the set of groups of data points to determine adigital signature of the article and processes the digital signature todetermine a printable label pattern that encodes the digital signatureaccording to a machine-readable encoding protocol; and wherein theprinter driver further creates instructions for the printing device toprint the label pattern onto the article.
 2. An apparatus for verifyingthe authenticity of articles, comprising: a scanning device that scansan article conveyed relative to the scanning device, the scanning devicecomprising: a coherent source that emits light as an article is conveyedrelative to the scanning device by the feed mechanism so as tosequentially illuminate a plurality of regions of an article; and adetector arrangement that detects light scattered from surface structureof the article so as to collect a set comprising groups of data pointswherein each of the groups of data points relates to scatter caused bysurface structure from the respective different regions of the surfaceof the article; a processor that processes the set of groups of datapoint to determine a digital signature of the article; a reading devicethat reads a printed label from the article; a decoder that decodes theread label to extract a previously determined signature for the article;and a signature verification module that compares the determined digitalsignature and the previously determined digital signature to establishwhether a match exists.
 3. Apparatus comprising: an article transportthat conveys articles to be printed along an article transport path; anarticle scanner arranged adjacent the article transport path, thearticle scanner comprising: a light source that emits coherent light asan article is conveyed along the article transport path relative to thearticle scanner, thereby sequentially illuminating a plurality ofregions of an article; and a detector arrangement that detects lightscattered from surface structure of an article illuminated by light fromthe light source and creates a set of data points describing the lightintensity received at the detector arrangement, the detector arrangementsequentially outputting the set of data points in groups of data pointswherein each group of data points relates to scatter caused by surfacestructure from a respective different region of the surface of thearticle; a processor that receives the set of groups of data points andprocesses the set of groups of data points to determine a digitalsignature of the article and that processes the digital signature todetermine a printable label pattern that encodes the digital signatureaccording to a machine-readable encoding protocol; and a print head thatprints the label pattern onto the article.
 4. The apparatus of claim 3,further comprising: a reading device that reads a printed label from anarticle conveyed along the article transport path; a decoder thatdecodes the read label to extract a previously determined signature forthe article; and a signature verification module that compares thedetermined digital signature and the previously determined digitalsignature to establish whether a match exists.
 5. An apparatus forcreating authenticatable articles, comprising: a printer driver thatcreates instructions for a printing device to print an image; a dataacquisition interface that receives a set comprising groups of datapoints from a printing device comprising: a feed mechanism that conveysan article past the print head; and a scan head that scans an articleconveyed through the printing device by the feed mechanism, the scanhead comprising: a coherent source that emits light as an article isconveyed past the scan head by the feed mechanism to sequentiallyilluminate each of a plurality of regions of a surface of an article;and a detector arrangement, that detects light scattered from surfacestructure of the article to collect a set comprising groups of datapoints wherein each of the groups of data points relates to scattercaused by surface structure from the respective different regions of thesurface of the article; and a processor that that processes the set ofgroups of data points to determine a digital signature of the articleand creates a record in a database, wherein the record includes thedigital signature and a representation of the image.
 6. An apparatus forverifying the authenticity of articles, comprising: a scanning devicethat scans an article conveyed relative to the scanning device, thescanning device comprising: a coherent source that emits light as anarticle is conveyed relative to the scanning device by the feedmechanism so as to sequentially illuminate a plurality of regions of asurface of an article; and a detector arrangement that detects lightscattered from surface structure of the article so as to collect a setcomprising groups of data points wherein each of the groups of datapoints relates to scatter caused by surface structure from therespective different regions of the surface of the article; a processorthat processes the set of groups of data point to determine a digitalsignature of the article; a database comprising a plurality of recordsof previously scanned articles, each record including the digitalsignature previously determined for that article and a visualrepresentation of that article; and a signature verification module thatsearches the database to establish whether there is a match between adigital signature obtained by the scanning device and a digitalsignature stored in one of the records, and that displays, if a match isfound, the visual representation of the article stored in the recordwith the match.
 7. Apparatus comprising: an article transport thatconveys articles to be printed along an article transport path; anarticle scanner arranged adjacent the article transport path, thearticle scanner comprising: a light source that emits coherent light asan article is conveyed along the article transport path relative to thearticle scanner, thereby sequentially illuminating a plurality ofregions of an article; and a detector arrangement that detects lightscattered from surface structure of an article illuminated by light fromthe light source and creates a set of data points describing the lightintensity received at the detector arrangement, the detector arrangementsequentially outputting the set of data points in groups of data pointswherein each group of data points relates to scatter caused by surfacestructure from a respective different region of the surface of thearticle; a processor that receives the set of groups of data points andprocesses the set of groups of data points to determine a digitalsignature of the article and that sends the digital signature and avisual representation of the article to be stored to a database.
 8. Theapparatus of claim 7, further comprising: a signature verificationmodule that searches the database to establish whether there is a matchbetween a digital signature obtained by the scanning device and adigital signature stored in a record of the database, and that displays,if a match is found, the visual representation of the article stored inthe record with the match.